[MDEV-26813] ASAN: use-after-poison in wkb_get_double in sql/spatial.cc on SELECT ST_GEOMFROMWKB Created: 2021-10-13  Updated: 2023-11-28

Status: Confirmed
Project: MariaDB Server
Component/s: GIS
Affects Version/s: 10.2, 10.3, 10.4, 10.5, 10.6, 10.9, 10.10, 10.11, 11.0, 11.1
Fix Version/s: 10.4, 10.5, 10.6, 10.11, 11.0, 11.1

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Alexey Botchkov
Resolution: Unresolved Votes: 0
Labels: ASAN, GIS, memory_corruption


 Description   

SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000);

Leads to:

10.7.1 8dd4794c4e11b8790fadf0c203bcd118e7b755e8 (Optimized)

==2565397==ERROR: AddressSanitizer: use-after-poison on address 0x629000087a2e at pc 0x5592d62b66f8 bp 0x153438dd7020 sp 0x153438dd7010
SUMMARY: AddressSanitizer: use-after-poison /test/10.7_opt_san/sql/spatial.cc:432 in wkb_get_double

10.7.1 8dd4794c4e11b8790fadf0c203bcd118e7b755e8 (Optimized)

==2565397==ERROR: AddressSanitizer: use-after-poison on address 0x629000087a2e at pc 0x5592d62b66f8 bp 0x153438dd7020 sp 0x153438dd7010
READ of size 8 at 0x629000087a2e thread T12
    #0 0x5592d62b66f7 in wkb_get_double /test/10.7_opt_san/sql/spatial.cc:432
    #1 0x5592d62b66f7 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/10.7_opt_san/sql/spatial.cc:935
    #2 0x5592d62ccf7a in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/10.7_opt_san/sql/spatial.cc:3390
    #3 0x5592d62db2f6 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/10.7_opt_san/sql/spatial.cc:483
    #4 0x5592d5b84137 in Item_func_geometry_from_wkb::val_str(String*) /test/10.7_opt_san/sql/item_geofunc.cc:112
    #5 0x5592d4dd42fd in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/10.7_opt_san/sql/sql_type.cc:7455
    #6 0x5592d3a4b791 in Protocol::send_result_set_row(List<Item>*) /test/10.7_opt_san/sql/protocol.cc:1327
    #7 0x5592d3db3839 in select_send::send_data(List<Item>&) /test/10.7_opt_san/sql/sql_class.cc:3072
    #8 0x5592d4479b77 in JOIN::exec_inner() /test/10.7_opt_san/sql/sql_select.cc:4601
    #9 0x5592d447db99 in JOIN::exec() /test/10.7_opt_san/sql/sql_select.cc:4513
    #10 0x5592d446d705 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.7_opt_san/sql/sql_select.cc:4991
    #11 0x5592d44715b3 in handle_select(THD*, LEX*, select_result*, unsigned long) /test/10.7_opt_san/sql/sql_select.cc:545
    #12 0x5592d40adf4f in execute_sqlcom_select /test/10.7_opt_san/sql/sql_parse.cc:6253
    #13 0x5592d40eda53 in mysql_execute_command(THD*, bool) /test/10.7_opt_san/sql/sql_parse.cc:3944
    #14 0x5592d407dfe8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.7_opt_san/sql/sql_parse.cc:8028
    #15 0x5592d40d3655 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.7_opt_san/sql/sql_parse.cc:1894
    #16 0x5592d40dee52 in do_command(THD*, bool) /test/10.7_opt_san/sql/sql_parse.cc:1402
    #17 0x5592d498a7bd in do_handle_one_connection(CONNECT*, bool) /test/10.7_opt_san/sql/sql_connect.cc:1418
    #18 0x5592d498d2b4 in handle_one_connection /test/10.7_opt_san/sql/sql_connect.cc:1312
    #19 0x5592d6955ce1 in pfs_spawn_thread /test/10.7_opt_san/storage/perfschema/pfs.cc:2201
    #20 0x15345931e608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
    #21 0x153458594292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
0x629000087a2e is located 2094 bytes inside of 16400-byte region [0x629000087200,0x62900008b210)
allocated by thread T12 here:
    #0 0x5592d386fab8 in __interceptor_malloc (/test/UBASAN_MD300921-mariadb-10.7.1-linux-x86_64-opt/bin/mariadbd+0x7b60ab8)
    #1 0x5592d81544cb in my_malloc /test/10.7_opt_san/mysys/my_malloc.c:90
    #2 0x5592d812ff30 in root_alloc /test/10.7_opt_san/mysys/my_alloc.c:66
    #3 0x5592d812ff30 in reset_root_defaults /test/10.7_opt_san/mysys/my_alloc.c:243
    #4 0x5592d3d7ae23 in THD::init_for_queries() /test/10.7_opt_san/sql/sql_class.cc:1405
    #5 0x5592d4984695 in prepare_new_connection_state(THD*) /test/10.7_opt_san/sql/sql_connect.cc:1240
    #6 0x5592d4985fd7 in thd_prepare_connection(THD*) /test/10.7_opt_san/sql/sql_connect.cc:1333
    #7 0x5592d4985fd7 in thd_prepare_connection(THD*) /test/10.7_opt_san/sql/sql_connect.cc:1322
    #8 0x5592d4989674 in do_handle_one_connection(CONNECT*, bool) /test/10.7_opt_san/sql/sql_connect.cc:1408
    #9 0x5592d498d2b4 in handle_one_connection /test/10.7_opt_san/sql/sql_connect.cc:1312
    #10 0x5592d6955ce1 in pfs_spawn_thread /test/10.7_opt_san/storage/perfschema/pfs.cc:2201
    #11 0x15345931e608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
Thread T12 created by T0 here:
    #0 0x5592d379c725 in __interceptor_pthread_create (/test/UBASAN_MD300921-mariadb-10.7.1-linux-x86_64-opt/bin/mariadbd+0x7a8d725)
    #1 0x5592d696e0cf in my_thread_create /test/10.7_opt_san/storage/perfschema/my_thread.h:48
    #2 0x5592d696e0cf in pfs_spawn_thread_v1 /test/10.7_opt_san/storage/perfschema/pfs.cc:2252
    #3 0x5592d38c3805 in inline_mysql_thread_create /test/10.7_opt_san/include/mysql/psi/mysql_thread.h:1139
    #4 0x5592d38c3805 in create_thread_to_handle_connection(CONNECT*) /test/10.7_opt_san/sql/mysqld.cc:5952
    #5 0x5592d38d7510 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/10.7_opt_san/sql/mysqld.cc:6073
    #6 0x5592d38d878b in handle_connections_sockets() /test/10.7_opt_san/sql/mysqld.cc:6197
    #7 0x5592d38dc409 in mysqld_main(int, char**) /test/10.7_opt_san/sql/mysqld.cc:5847
    #8 0x1534584990b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
 
SUMMARY: AddressSanitizer: use-after-poison /test/10.7_opt_san/sql/spatial.cc:432 in wkb_get_double
Shadow bytes around the buggy address:
  0x0c5280008ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280008f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280008f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280008f20: 00 00 00 00 00 00 f7 00 00 f7 00 07 f7 00 00 00
  0x0c5280008f30: 00 00 05 f7 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c5280008f40: 00 00 f7 00 00[07]f7 00 00 00 00 00 07 f7 00 00
  0x0c5280008f50: 00 f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280008f60: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00
  0x0c5280008f70: 00 00 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00
  0x0c5280008f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280008f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

Setup:

Compiled with GCC >=7.5.0 (I use GCC 9.3.0) and:
    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWITH_RAPID=OFF -DWSREP_LIB_WITH_ASAN=ON
Set before execution:
    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=1:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1

Bug confirmed present in:
MariaDB: 10.2.41 (dbg), 10.2.41 (opt), 10.3.32 (dbg), 10.3.32 (opt), 10.4.22 (dbg), 10.4.22 (opt), 10.5.13 (dbg), 10.5.13 (opt), 10.6.5 (dbg), 10.6.5 (opt), 10.7.1 (dbg), 10.7.1 (opt)



 Comments   
Comment by Roel Van de Paar [ 2023-05-13 ]

Executing this query in a debug UBSAN+ASAN build of 11.0 results in the query thread hanging for quite some time before the server crashes:

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

11.0.2-dbg>show processlist;
+----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+
| Id | User | Host      | db   | Command | Time | State     | Info                                                                   | Progress |
+----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+
|  4 | root | localhost | test | Query   |   45 | Executing | SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000) |    0.000 |
|  5 | root | localhost | test | Query   |    0 | starting  | show processlist                                                       |    0.000 |
+----+------+-----------+------+---------+------+-----------+------------------------------------------------------------------------+----------+
2 rows in set (0.001 sec)

And we see the following ASAN error & stack:

11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

==3609113==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7a96 at pc 0x5582e74dbed2 bp 0x14e618bba030 sp 0x14e618bba020
READ of size 8 at 0x6290000d7a96 thread T18
    #0 0x5582e74dbed1 in wkb_get_double /test/11.0_dbg_san/sql/spatial.cc:428
    #1 0x5582e74e5037 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:936
    #2 0x5582e750c912 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:3404
    #3 0x5582e7518d03 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.0_dbg_san/sql/spatial.cc:483
    #4 0x5582e6cc49d0 in Item_func_geometry_from_wkb::val_str(String*) /test/11.0_dbg_san/sql/item_geofunc.cc:112
    #5 0x5582e5d647af in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
    #6 0x5582e57adcf2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
    #7 0x5582e453f888 in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
    #8 0x5582e46fbe96 in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
    #9 0x5582e4ac74a8 in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
    #10 0x5582e5249e7a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
    #11 0x5582e5249e7a in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4766
    #12 0x5582e5250916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
    #13 0x5582e523f0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
    #14 0x5582e524351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
    #15 0x5582e4db5a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
    #16 0x5582e4e16ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
    #17 0x5582e4e46973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
    #18 0x5582e4e56707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
    #19 0x5582e4e64542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
    #20 0x5582e58398b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
    #21 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
    #22 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
    #23 0x14e63b9269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
0x6290000d7a96 is located 2198 bytes inside of 16400-byte region [0x6290000d7200,0x6290000db210)
allocated by thread T18 here:
    #0 0x5582e44cb337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
    #1 0x5582e8be2703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
    #2 0x5582e8bc0f22 in root_alloc /test/11.0_dbg_san/mysys/my_alloc.c:71
    #3 0x5582e8bc1dec in reset_root_defaults /test/11.0_dbg_san/mysys/my_alloc.c:248
    #4 0x5582e4a76ec1 in THD::init_for_queries() /test/11.0_dbg_san/sql/sql_class.cc:1386
    #5 0x5582e58355cc in prepare_new_connection_state(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1245
    #6 0x5582e5836d7a in thd_prepare_connection(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1339
    #7 0x5582e583a134 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1406
    #8 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
    #9 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
 
Thread T18 created by T0 here:
    #0 0x5582e446f175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
    #1 0x5582e452598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
    #2 0x5582e4532e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
    #3 0x5582e45336e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
    #4 0x5582e4534738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
    #5 0x5582e453bee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
    #6 0x5582e4510eca in main /test/11.0_dbg_san/sql/main.cc:34
    #7 0x14e63b829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/sql/spatial.cc:428 in wkb_get_double
Shadow bytes around the buggy address:
  0x0c5280012f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f30: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7
  0x0c5280012f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
=>0x0c5280012f50: 00 00[07]f7 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f60: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00
  0x0c5280012f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f80: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00
  0x0c5280012f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06
  0x0c5280012fa0: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3609113==ABORTING
230513 13:39:01 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
 
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
 
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.
 
Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a
key_buffer_size=134217728
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
 
Thread pointer: 0x62b00015e218
Attempting backtrace. You can use the following information to find out==3609113==ERROR: AddressSanitizer: use-after-poison on address 0x6290000d7a96 at pc 0x5582e74dbed2 bp 0x14e618bba030 sp 0x14e618bba020
READ of size 8 at 0x6290000d7a96 thread T18
    #0 0x5582e74dbed1 in wkb_get_double /test/11.0_dbg_san/sql/spatial.cc:428
    #1 0x5582e74e5037 in Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:936
    #2 0x5582e750c912 in Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*) /test/11.0_dbg_san/sql/spatial.cc:3404
    #3 0x5582e7518d03 in Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*) /test/11.0_dbg_san/sql/spatial.cc:483
    #4 0x5582e6cc49d0 in Item_func_geometry_from_wkb::val_str(String*) /test/11.0_dbg_san/sql/item_geofunc.cc:112
    #5 0x5582e5d647af in Type_handler::Item_send_str(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.cc:7446
    #6 0x5582e57adcf2 in Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const /test/11.0_dbg_san/sql/sql_type.h:5455
    #7 0x5582e453f888 in Item::send(Protocol*, st_value*) /test/11.0_dbg_san/sql/item.h:1235
    #8 0x5582e46fbe96 in Protocol::send_result_set_row(List<Item>*) /test/11.0_dbg_san/sql/protocol.cc:1332
    #9 0x5582e4ac74a8 in select_send::send_data(List<Item>&) /test/11.0_dbg_san/sql/sql_class.cc:3102
    #10 0x5582e5249e7a in select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long) /test/11.0_dbg_san/sql/sql_class.h:5748
    #11 0x5582e5249e7a in JOIN::exec_inner() /test/11.0_dbg_san/sql/sql_select.cc:4766
    #12 0x5582e5250916 in JOIN::exec() /test/11.0_dbg_san/sql/sql_select.cc:4677
    #13 0x5582e523f0c1 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/11.0_dbg_san/sql/sql_select.cc:5158
    #14 0x5582e524351c in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/11.0_dbg_san/sql/sql_select.cc:616
    #15 0x5582e4db5a01 in execute_sqlcom_select /test/11.0_dbg_san/sql/sql_parse.cc:6279
    #16 0x5582e4e16ef5 in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:3949
    #17 0x5582e4e46973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
    #18 0x5582e4e56707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
    #19 0x5582e4e64542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
    #20 0x5582e58398b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
    #21 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
    #22 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
    #23 0x14e63b9269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
0x6290000d7a96 is located 2198 bytes inside of 16400-byte region [0x6290000d7200,0x6290000db210)
allocated by thread T18 here:
    #0 0x5582e44cb337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
    #1 0x5582e8be2703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
    #2 0x5582e8bc0f22 in root_alloc /test/11.0_dbg_san/mysys/my_alloc.c:71
    #3 0x5582e8bc1dec in reset_root_defaults /test/11.0_dbg_san/mysys/my_alloc.c:248
    #4 0x5582e4a76ec1 in THD::init_for_queries() /test/11.0_dbg_san/sql/sql_class.cc:1386
    #5 0x5582e58355cc in prepare_new_connection_state(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1245
    #6 0x5582e5836d7a in thd_prepare_connection(THD*) /test/11.0_dbg_san/sql/sql_connect.cc:1339
    #7 0x5582e583a134 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1406
    #8 0x5582e583add0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
    #9 0x14e63b894b42 in start_thread nptl/pthread_create.c:442
 
Thread T18 created by T0 here:
    #0 0x5582e446f175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
    #1 0x5582e452598b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
    #2 0x5582e4532e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
    #3 0x5582e45336e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
    #4 0x5582e4534738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
    #5 0x5582e453bee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
    #6 0x5582e4510eca in main /test/11.0_dbg_san/sql/main.cc:34
    #7 0x14e63b829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/sql/spatial.cc:428 in wkb_get_double
Shadow bytes around the buggy address:
  0x0c5280012f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f30: 00 00 f7 00 00 f7 00 07 f7 00 00 00 00 00 05 f7
  0x0c5280012f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
=>0x0c5280012f50: 00 00[07]f7 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f60: 00 00 00 00 00 03 f7 00 00 00 f7 00 00 f7 00 00
  0x0c5280012f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c5280012f80: 00 00 00 00 f7 00 00 f7 00 00 00 00 00 00 00 00
  0x0c5280012f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06
  0x0c5280012fa0: f7 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3609113==ABORTING
230513 13:39:01 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
 
To report this bug, see https://mariadb.com/kb/en/reporting-bugs
 
We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed, 
something is definitely wrong and this may fail.
 
Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a
key_buffer_size=134217728
read_buffer_size=131072
max_used_connections=1
max_threads=153
thread_count=1
It is possible that mysqld could use up to 
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K  bytes of memory
Hope that's ok; if not, decrease some variables in the equation.
 
Thread pointer: 0x62b00015e218
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x14e618bbdac0 thread_stack 0x100000
asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x5582e445c6fe]
mysys/stacktrace.c:215(my_print_stacktrace)[0x5582e8bef001]
sql/signal_handler.cc:238(handle_fatal_signal)[0x5582e650a534]
libc_sigaction.c:0(__restore_rt)[0x14e63b842520]
nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14e63b896a7c]
posix/raise.c:27(__GI_raise)[0x14e63b842476]
stdlib/abort.c:81(__GI_abort)[0x14e63b8287f3]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x5582e44e91c2]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x5582e44f4d7c]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x5582e44d422c]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x5582e44d3ac5]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load_n+0x38)[0x5582e44d50e8]
sql/spatial.cc:432(wkb_get_double(char const*, Geometry::wkbByteOrder))[0x5582e74dbed2]
sql/spatial.cc:936(Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e74e5038]
sql/spatial.cc:3403(Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e750c913]
sql/spatial.cc:484(Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*))[0x5582e7518d04]
sql/item_geofunc.cc:112(Item_func_geometry_from_wkb::val_str(String*))[0x5582e6cc49d1]
sql/sql_type.cc:7446(Type_handler::Item_send_str(Item*, Protocol*, st_value*) const)[0x5582e5d647b0]
sql/sql_type.h:5456(Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const)[0x5582e57adcf3]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79d8889)[0x5582e453f889]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN8Protocol19send_result_set_rowEP4ListI4ItemE+0xa6b)[0x5582e46fbe97]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN11select_send9send_dataER4ListI4ItemE+0x289)[0x5582e4ac74a9]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN10exec_innerEv+0x4607)[0x5582e5249e7b]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN4execEv+0x195)[0x5582e5250917]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x844)[0x5582e523f0c2]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0xb00)[0x5582e524351d]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x824ea02)[0x5582e4db5a02]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0xb4af)[0x5582e4e16ef6]
sql/item.h:1236(Item::send(Protocol*, st_value*))[0x5582e4e46974]
sql/protocol.cc:1332(Protocol::send_result_set_row(List<Item>*))[0x5582e4e56708]
sql/sql_class.cc:3102(select_send::send_data(List<Item>&))[0x5582e4e64543]
sql/sql_class.h:5748(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x5582e58398b6]
sql/sql_select.cc:4677(JOIN::exec())[0x5582e583add1]
nptl/pthread_create.c:442(start_thread)[0x14e63b894b43]
x86_64/clone3.S:83(__clone3)[0x14e63b926a00]
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x6290000d73f0): SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000)
 
Connection ID (thread ID): 4
Status: NOT_KILLED
 
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x14e618bbdac0 thread_stack 0x100000
asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x5582e445c6fe]
mysys/stacktrace.c:215(my_print_stacktrace)[0x5582e8bef001]
sql/signal_handler.cc:238(handle_fatal_signal)[0x5582e650a534]
libc_sigaction.c:0(__restore_rt)[0x14e63b842520]
nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14e63b896a7c]
posix/raise.c:27(__GI_raise)[0x14e63b842476]
stdlib/abort.c:81(__GI_abort)[0x14e63b8287f3]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x5582e44e91c2]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x5582e44f4d7c]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x5582e44d422c]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x5582e44d3ac5]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load_n+0x38)[0x5582e44d50e8]
sql/spatial.cc:432(wkb_get_double(char const*, Geometry::wkbByteOrder))[0x5582e74dbed2]
sql/spatial.cc:936(Gis_point::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e74e5038]
sql/spatial.cc:3403(Gis_geometry_collection::init_from_wkb(char const*, unsigned int, Geometry::wkbByteOrder, String*))[0x5582e750c913]
sql/spatial.cc:484(Geometry::create_from_wkb(Geometry_buffer*, char const*, unsigned int, String*))[0x5582e7518d04]
sql/item_geofunc.cc:112(Item_func_geometry_from_wkb::val_str(String*))[0x5582e6cc49d1]
sql/sql_type.cc:7446(Type_handler::Item_send_str(Item*, Protocol*, st_value*) const)[0x5582e5d647b0]
sql/sql_type.h:5456(Type_handler_string_result::Item_send(Item*, Protocol*, st_value*) const)[0x5582e57adcf3]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79d8889)[0x5582e453f889]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN8Protocol19send_result_set_rowEP4ListI4ItemE+0xa6b)[0x5582e46fbe97]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN11select_send9send_dataER4ListI4ItemE+0x289)[0x5582e4ac74a9]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN10exec_innerEv+0x4607)[0x5582e5249e7b]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_ZN4JOIN4execEv+0x195)[0x5582e5250917]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z12mysql_selectP3THDP10TABLE_LISTR4ListI4ItemEPS4_jP8st_orderS9_S7_S9_yP13select_resultP18st_select_lex_unitP13st_select_lex+0x844)[0x5582e523f0c2]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z13handle_selectP3THDP3LEXP13select_resulty+0xb00)[0x5582e524351d]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x824ea02)[0x5582e4db5a02]
/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(_Z21mysql_execute_commandP3THDb+0xb4af)[0x5582e4e16ef6]
sql/item.h:1236(Item::send(Protocol*, st_value*))[0x5582e4e46974]
sql/protocol.cc:1332(Protocol::send_result_set_row(List<Item>*))[0x5582e4e56708]
sql/sql_class.cc:3102(select_send::send_data(List<Item>&))[0x5582e4e64543]
sql/sql_class.h:5748(select_result_sink::send_data_with_check(List<Item>&, st_select_lex_unit*, unsigned long long))[0x5582e58398b6]
sql/sql_select.cc:4677(JOIN::exec())[0x5582e583add1]
nptl/pthread_create.c:442(start_thread)[0x14e63b894b43]
x86_64/clone3.S:83(__clone3)[0x14e63b926a00]
 
Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x6290000d73f0): SELECT ST_GEOMFROMWKB (0x01070000000100000002010000000000000000000000)
 
Connection ID (thread ID): 4
Status: NOT_KILLED

Generated at Thu Feb 08 09:48:08 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.